salt 3004 vulnerabilities

Known vulnerabilities in the salt package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
H Directory Traversal salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Directory Traversal via the `serve_file` method, due to insufficient checks in the `salt/fileserver/roots.py` file. How to fix Directory Traversal? Upgrade `salt` to version 3005.5 or higher.	[,3005.5)
H Directory Traversal salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Directory Traversal when establishing the syndic cache directory on the master. How to fix Directory Traversal? Upgrade `salt` to version 3005.5 or higher.	[,3005.5)
M Improper Access Control salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Improper Access Control. The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. How to fix Improper Access Control? Upgrade `salt` to version 3005.4, 3006.4 or higher.	[,3005.4)[3006.0rc1,3006.4)
M Information Exposure salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Information Exposure and other possible impacts, due to a hash collision when using Git Providers reading from different environments. If Git Providers read from the wrong environment because they get the same cache directory base name, they could get bad data or unintended data. This could also lead to wrongful executions, data corruption or a crash. How to fix Information Exposure? Upgrade `salt` to version 3005.2, 3006.2 or higher.	[,3005.2)[3006.0rc1,3006.2)
H Denial of Service (DoS) salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Denial of Service (DoS) in the error message decoding mechanism in minion return. If the request server receives a number of requests equal to the number of worker threads, the master will become unresponsive to return requests until it is restarted. How to fix Denial of Service (DoS)? Upgrade `salt` to version 3005.2, 3006.2 or higher.	[,3005.2)[3006.0rc1,3006.2)
H Buffer Overflow salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Buffer Overflow via the `status` function. How to fix Buffer Overflow? There is no fixed version for `salt`.	[0,)
H Denial of Service (DoS) salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Denial of Service (DoS) in `junos ifconfig` output parsing. How to fix Denial of Service (DoS)? Upgrade `salt` to version 3004.1 or higher.	[,3004.1)
H Access Restriction Bypass salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Access Restriction Bypass where a previously authorized user whose account is locked can still run Salt commands. This affects both local shell accounts with an active session and `salt-api` users that authenticate via `PAM` `eauth`. Workaround: If the user can not upgrade to the fixed version, it is possible to: remove locked accounts rather than rely on Salt’s PAM `eauth` functionality. change to a different `eauth` module. How to fix Access Restriction Bypass? Upgrade `salt` to version 3002.9, 3003.5, 3004.2 or higher.	[,3002.9)[3003,3003.5)[3004,3004.2)
H Improper Access Control salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Improper Access Control which allows users specified in the `publisher_acl` to publish authorized commands to any configured minion. Note: This requires a syndic master combined with `publisher_acl` configured on the Master-of-Masters. How to fix Improper Access Control? Upgrade `salt` to version 3002.8, 3003.4, 3004.1 or higher.	[,3002.8)[3003,3003.4)[3004,3004.1)
M Denial of Service (DoS) salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Denial of Service (DoS). A MiTM attacker to force a minion process to stop by impersonating a master. How to fix Denial of Service (DoS)? Upgrade `salt` to version 3002.8, 3003.4, 3004.1 or higher.	[,3002.8)[3003,3003.4)[3004,3004.1)
H Access Restriction Bypass salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Access Restriction Bypass which can allow attackers to substitute arbitrary pillar data, because Salt Masters do not sign pillar data with the minion’s public key. How to fix Access Restriction Bypass? Upgrade `salt` to version 3002.8, 3003.4, 3004.1 or higher.	[,3002.8)[3003,3003.4)[3004,3004.1)
M Authentication Bypass salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable to Authentication Bypass which can result in an attacker replaying job publishes causing minions to run old jobs. File server replies can also be re-played. A sufficient craft attacker could gain root access to minion under certain scenarios. How to fix Authentication Bypass? Upgrade `salt` to version 3002.8, 3003.4, 3004.1 or higher.	[,3002.8)[3003,3003.4)[3004,3004.1)

Vulnerability

Vulnerable Version

Directory Traversal

salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more.

Affected versions of this package are vulnerable to Directory Traversal via the serve_file method, due to insufficient checks in the salt/fileserver/roots.py file.

How to fix Directory Traversal?

Upgrade salt to version 3005.5 or higher.

[,3005.5)

Directory Traversal

Affected versions of this package are vulnerable to Directory Traversal when establishing the syndic cache directory on the master.

How to fix Directory Traversal?

Upgrade salt to version 3005.5 or higher.

[,3005.5)

Improper Access Control

Affected versions of this package are vulnerable to Improper Access Control. The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH.

How to fix Improper Access Control?

Upgrade salt to version 3005.4, 3006.4 or higher.

[,3005.4)[3006.0rc1,3006.4)

Information Exposure

Affected versions of this package are vulnerable to Information Exposure and other possible impacts, due to a hash collision when using Git Providers reading from different environments. If Git Providers read from the wrong environment because they get the same cache directory base name, they could get bad data or unintended data. This could also lead to wrongful executions, data corruption or a crash.

How to fix Information Exposure?

Upgrade salt to version 3005.2, 3006.2 or higher.

[,3005.2)[3006.0rc1,3006.2)

Denial of Service (DoS)

Affected versions of this package are vulnerable to Denial of Service (DoS) in the error message decoding mechanism in minion return. If the request server receives a number of requests equal to the number of worker threads, the master will become unresponsive to return requests until it is restarted.

How to fix Denial of Service (DoS)?

Upgrade salt to version 3005.2, 3006.2 or higher.

[,3005.2)[3006.0rc1,3006.2)

Buffer Overflow

Affected versions of this package are vulnerable to Buffer Overflow via the status function.

How to fix Buffer Overflow?

There is no fixed version for salt.

[0,)

Denial of Service (DoS)

Affected versions of this package are vulnerable to Denial of Service (DoS) in junos ifconfig output parsing.

How to fix Denial of Service (DoS)?

Upgrade salt to version 3004.1 or higher.

[,3004.1)

Access Restriction Bypass

Affected versions of this package are vulnerable to Access Restriction Bypass where a previously authorized user whose account is locked can still run Salt commands. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.

Workaround: If the user can not upgrade to the fixed version, it is possible to:

remove locked accounts rather than rely on Salt’s PAM eauth functionality.
change to a different eauth module.

How to fix Access Restriction Bypass?

Upgrade salt to version 3002.9, 3003.5, 3004.2 or higher.

[,3002.9)[3003,3003.5)[3004,3004.2)

Improper Access Control

Affected versions of this package are vulnerable to Improper Access Control which allows users specified in the publisher_acl to publish authorized commands to any configured minion. Note: This requires a syndic master combined with publisher_acl configured on the Master-of-Masters.

How to fix Improper Access Control?

Upgrade salt to version 3002.8, 3003.4, 3004.1 or higher.

[,3002.8)[3003,3003.4)[3004,3004.1)

Denial of Service (DoS)

Affected versions of this package are vulnerable to Denial of Service (DoS). A MiTM attacker to force a minion process to stop by impersonating a master.

How to fix Denial of Service (DoS)?

Upgrade salt to version 3002.8, 3003.4, 3004.1 or higher.

[,3002.8)[3003,3003.4)[3004,3004.1)

Access Restriction Bypass

Affected versions of this package are vulnerable to Access Restriction Bypass which can allow attackers to substitute arbitrary pillar data, because Salt Masters do not sign pillar data with the minion’s public key.

How to fix Access Restriction Bypass?

Upgrade salt to version 3002.8, 3003.4, 3004.1 or higher.

[,3002.8)[3003,3003.4)[3004,3004.1)

Authentication Bypass

Affected versions of this package are vulnerable to Authentication Bypass which can result in an attacker replaying job publishes causing minions to run old jobs. File server replies can also be re-played. A sufficient craft attacker could gain root access to minion under certain scenarios.

How to fix Authentication Bypass?

Upgrade salt to version 3002.8, 3003.4, 3004.1 or higher.

[,3002.8)[3003,3003.4)[3004,3004.1)

salt@3004 vulnerabilities

Portable, distributed, remote execution and configuration management system

latest version

first published

latest version published

licenses detected

Direct Vulnerabilities

How to fix?